What to do in the first hour if you think your bank account is compromised

First, check it is real, using your own route in

If the warning arrived as a text, email or call, do not use its links or numbers. Open your bank's app or type its address yourself and look at recent activity. Many 'your account is compromised' messages are the scam itself.

If you see a transaction, a payee, a changed address or a sign-in that you do not recognize, treat it as real and keep going.

Minutes 0 to 15: stop the bleeding

Speed matters legally as well as practically. In the US, your protection against unauthorized debit card and bank transfers depends on how quickly you report them, and it weakens the longer you wait. Credit cards carry stronger protection, but report promptly either way.

• Lock or freeze the affected card in the bank's app. Most banks have a switch that takes effect instantly and can be reversed.
• Call the bank on the number on the back of your card or on its official website. Say you believe the account is compromised, and ask them to block further transactions and dispute the ones you did not make.
• Ask whether any transfers are still pending. A payment that has not settled can sometimes be stopped.
• Write down the time, the name of the person you spoke to and any reference number.

Minutes 15 to 40: lock the doors

• From a device you trust, change the password on the bank account. Make it unique.
• Change your email password next, and check the email account for forwarding rules or recovery addresses you did not add. Whoever controls your inbox can reset everything else.
• Turn on two-factor authentication on both, or reset it if it was already on.
• Use the 'sign out of all devices' option where one exists.
• If you reused the old password anywhere else, change it there too.

Minutes 40 to 60: cut outside access and look wider

• Review the apps connected to your bank, through the bank's connected apps page and Plaid's portal at my.plaid.com, and remove anything you do not recognize or use.
• Check your other financial accounts for unfamiliar activity, especially ones sharing the same email address or password.
• Check your phone account. If your phone suddenly lost service, your number may have been moved to another SIM; call your carrier from another phone.
• If you installed anything at a caller's request, or let someone view your screen, disconnect that device from the internet and have it checked before you use it for banking again.

The next few days

• Follow up the phone report in writing if your bank asks for it, and keep copies.
• Place a credit freeze with each of the three credit bureaus if any identifying details were exposed. It is free and stops new accounts being opened in your name.
• In the US, report identity theft at IdentityTheft.gov, which produces a recovery plan and a report you can give to banks.
• Update automatic payments that used a card you had to replace.
• Keep checking statements for a few months. Stolen details are sometimes used long after they were taken.

What not to do

• Do not move money to a 'safe account' because someone told you to. That instruction is always a scam.
• Do not pay anyone who promises to recover lost money for a fee.
• Do not keep using a device you suspect is infected for banking.
• Do not wait to see whether more charges appear before reporting.

Where a budgeting app fits in

A read-only budgeting app cannot move money, so it is rarely the way in. It is still worth securing as part of the sweep, because it shows your balances and history: change its password, check its list of active sessions, and sign out devices you do not recognize.

It can also help you notice trouble early. Seeing every account's transactions in one list makes an unfamiliar charge stand out days sooner than waiting for a statement. In My AI Fin App, settings shows your sign-in history and active sessions, and a sign-in from a new device triggers an email with a link that ends every session if it was not you.